API business-logic abuse: valid requests can still cause harm
An API request can be correctly formatted and still misuse a workflow. Review the business outcome, especially repeated actions, ownership checks, and limits that span several requests.
Read the visual guide
